MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93908b3545a7c137ee9d9b8c496fc01b2847538bc25768470bf3c2665c6a3b32. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Formbook


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93908b3545a7c137ee9d9b8c496fc01b2847538bc25768470bf3c2665c6a3b32
SHA3-384 hash: fa1c06ab458534419e4c09ff597ca0cfb12a76b5f846490d2a1cd31ac9164704c461b3fec6d7cee72dfd49438f9c94ac
SHA1 hash: d52121a4a75a92a6c5ce5dd00a3aa64303118c0e
MD5 hash: de9da3abf6aafbfc2d213f88329c30a3
humanhash: oven-network-august-india
File name:PO9943441.xls.rar
Download: download sample
Signature Formbook
Create hunting rule
File size:275'183 bytes
First seen:2020-08-18 19:20:56 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 6144:3uL1hTBODR+/O57y9VqnWVjdwn7bobIJ0J9+JuW:kh8E/d9VqnWxdwYbImJ9mf
TLSH BB4423F0FA1D2025E8128C5B1D119BFF53800750DF696689CDD19EBAB35DBB710ABAC1
Reporter abuse_ch
Tags:FormBook rar


Avatar
abuse_ch
Malspam distributing Formbook:

HELO: slot0.sanrentas.com
Sending IP: 104.168.236.22
From: import and export department <info@sanrentas.com>
Reply-To: import and export department <info@sanrentas.com>
Subject: order PO#9943441
Attachment: PO9943441.xls.rar (contains "PO#9943441.xls.exe")

Intelligence

File Origin
# of uploads :
1
# of downloads :
89
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.27363.Rar5Heur.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93908b3545a7c137ee9d9b8c496fc01b2847538bc25768470bf3c2665c6a3b32/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-18 15:55:58 UTC
AV detection:
18 of 48 (37.50%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=soiiwnkfu7atp3u5toges36admueou4lyjlwqryl6pbgmxdkhmza._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/93908b3545a7c137ee9d9b8c496fc01b2847538bc25768470bf3c2665c6a3b32

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Formbook

rar 93908b3545a7c137ee9d9b8c496fc01b2847538bc25768470bf3c2665c6a3b32

(this sample)

Formbook

Executable exe 415c22ceb1927b67c21bd55423f75713b29ca6950e806387e28abbbf19ccc8bd

  
Dropping
MD5 d805ae4b8c9cc7d49432a7dd3f5de693
  
Dropping
Formbook
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 415c22ceb1927b67c21bd55423f75713b29ca6950e806387e28abbbf19ccc8bd

Comments